Privacy Policy

1. Who we are

Ipoh.my is operated by Tech Ninja Enterprise (003276888-W), a business registered in Malaysia. We are responsible for the personal data described in this policy, which we handle under Malaysia's Personal Data Protection Act 2010. Contact us about it at [email protected].

2. What we collect

• Your account. Your name, email address and password (stored only in scrambled, hashed form), and whether you have verified your email.
• What you do while signed in. The places and videos you like or bookmark, the videos you submit, and the reports you make.
• Claims. When you claim a place or a creator profile: your note and any proof link you give us. If you verify a YouTube channel, we sign you in with Google once to read your channel's ID, name, handle and picture. We do not keep your Google password, your Google email address, or the access Google grants us. If you verify a TikTok, Instagram or Facebook profile, we give you a one-time code: on TikTok or Instagram you send it to our @ipohdotmy account from that profile, and on Facebook you place it in your Page's Intro, where our team checks it by hand. We keep the code and when it was confirmed.
• Content-removal requests. The name, email address and explanation you give on the removal form, which works without an account.
• Advertising and payments. The banners, titles and links you submit, your campaigns, and your credit balance and history. For each payment we keep the amount, date, status and Stripe's record of the checkout, which includes the name, email address and phone number given at checkout until you delete your account.
• How the site is used. Each time a video is played, a link is followed, or an ad is shown or clicked, we record the event, the date, your account if you are signed in, and a hashed form of your IP address and session. We use these records to count views and clicks, to filter out bots and abuse, and to produce the totals shown to creators, businesses and advertisers.
• Email delivery. When we send you an email, our email provider tells us what happened to it, and we keep that record: the address it went to, when, and whether it was delivered, bounced or marked as spam. If an address bounces permanently or is marked as spam, we put it on a do-not-send list so that we stop emailing it.
• Technical data. While you are signed in, your session record holds your IP address and browser type. Your IP address is also held briefly to limit repeated attempts at logging in and at the removal form.

3. Cookies and local storage

We use only the cookies the site needs to work: a session cookie that keeps you signed in, a security token that protects forms, and a "remember me" cookie if you tick that box when logging in. Your browser's local storage holds your cookie-banner choice. We use no analytics cookies. Likes and bookmarks are stored in your account, not on your device.

4. Third-party embeds and maps

Embedded content from third-party platforms may set its own cookies and collect data according to those platforms' privacy policies, which we do not control. Our map loads its images from OpenStreetMap, which receives your IP address when it does.

The submission form uses Google Maps and Google Places for its map and place suggestions. Google receives your IP address and search text directly from your browser. If you choose “Use my location”, your location is used to position the Google map. These features are subject to Google’s Privacy Policy.

5. Advertising

We may show advertising on the Service. These ads are served by Ipoh.my itself — we do not use third-party ad networks and set no third-party advertising cookies. Advertisers receive only total counts of views and clicks, never who saw or clicked their ad. If we introduce a third-party ad or analytics partner in future, any non-essential cookies it sets will be gated behind your consent via our cookie banner (essential-only always remains an option), in line with Malaysia's PDPA.

6. How we use data

We use this data to run your account and the features you use, to review submissions, claims and removal requests, to take payments and run advertising campaigns, to count views and clicks, to prevent abuse and keep the Service secure, and to send the emails your account needs, such as email verification and password resets. We do not sell your personal data and we do not use it to build advertising profiles.

7. Who we share it with

We share personal data only with service providers who help us run the Service, or where the law requires it.

Payments. Card and online-banking payments are handled by Stripe, our payment processor. We never see or store your full card number. To take a payment we pass Stripe your name, email address and the amount. Stripe operates internationally, so this information is processed outside Malaysia, under Stripe's own privacy terms and the safeguards required of a data processor.

Error monitoring. When something breaks on the Service, we send a technical fault report to Sentry, our error-monitoring provider, so that we can find and fix it. A report describes the fault: the error message, the web address and form fields of the request that failed, the type of browser, and the trace through our own code. It is configured not to include your IP address or account details. It sets no cookies, is never used for advertising, profiling or analytics, and is kept only for a limited period set by that provider before deletion. Sentry stores these reports on servers in the European Union, so this information is processed outside Malaysia, under that region's data-protection safeguards and the obligations required of a data processor.

Google. If you verify a YouTube channel, Google handles that sign-in under its own privacy policy. Ipoh.my's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok, Instagram and Facebook. A message you send our @ipohdotmy account to verify a profile is held in that platform's inbox under that platform's own privacy policy, and is read only by the team that checks verifications. The @ipohdotmy accounts also check creator claims for Featured.my. You can delete the conversation on your side once your profile is verified.

Hosting and storage. Our servers, database and email delivery are run by hosting providers acting on our instructions. Advertising banners are stored with Amazon Web Services in its Malaysia region.

8. How long we keep it

We keep your account data while your account is open. When you delete your account, your account record is removed and you are signed out, and we delete your likes, bookmarks, notifications, sign-in sessions, any claims still waiting for review, and any creator portfolio you set up, with the name and @handle you chose for it. Some records stay after that, no longer tied to an account: videos you submitted, edits and reports you made, and claims we approved stay on the Service. Places and creator profiles you claimed stay listed but are released, so that nobody owns them, and a released creator profile loses its content licence. Payment, credit and campaign records are kept for as long as Malaysian law requires us to keep business and tax records, with the name, email address and phone number removed from Stripe's record of each checkout. Usage records, reports and removal requests are kept to run the Service and deal with disputes. Email delivery records are deleted after twelve months, whether or not you still have an account; an address on our do-not-send list stays there, because removing it would mean emailing it again. To ask us to delete something that stays behind, email us.

9. Your rights

You may ask for a copy of the personal data we hold about you, ask us to correct it, or withdraw consent for a use of it, by emailing [email protected]. You can change your name and email, or delete your account, from your profile page at any time. We may need to confirm who you are before acting on a request, and we will reply within the time the PDPA allows.

10. Children

The Service is not directed to children, and we do not knowingly collect personal data from them.

11. Changes

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.